Skip to content

v14.6.0 — company memory server, encrypted settings, privacy

Choose a tag to compare

View all tags
@vbcherepanov vbcherepanov released this 28 Sep 07:58
· 41 commits to main since this release
v14.6.0
7482d8a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A company memory server you can run, and a stricter personal install.

Company server

  • tam setup asks "Just me" or "Company server". A new team server shows a one-time setup code and runs a web wizard at /dashboard/.
  • Team dashboard:
    • invite codes and passwords;
    • roles: member, manager (department head), company viewer, superadmin;
    • overview pages, an audit log, reports;
    • provider settings. API keys are stored encrypted and never go back to the browser.
  • Department onboarding: /onboard builds lessons from the team's records, with quizzes and results for the department head.
  • PostgreSQL backend: set TAM_TEAM_DATABASE_URL or use Settings → Database, and move an existing server with tam-team db-migrate. Both backends return the same top 10 (Jaccard 1.0) and recall p50 is 485 vs 492 ms at 10k records.
  • Continuous backup with Litestream (TAM_TEAM_REPLICA_URL). Offboarding with user-disable, user-export and user-purge.
  • memory_report: an activity report for a day, week, month or custom range, on both the personal and the team server.

Personal install

  • Settings page in the local dashboard (/settings): language model, embeddings, the size of search answers, log retention and the stored-credential cleanup. API keys are stored encrypted in settings.json + master.key (0600). The setup wizard no longer writes keys into client configs.
  • Search answers cap each record at 6000 characters (memory_get still returns it whole). Records that address the agent ("ignore previous instructions") are flagged untrusted_instructions.
  • memory_delete(id, hard=true) erases a record together with its earlier versions, vectors, indexes and raw-log copies.

Security

  • Credentials reached disk in plain text. Every write tool except memory_save, the raw call log and the prompt hook stored them as typed, and memory_save missed current key formats (sk_live_, sk-ant-, sk-proj-, github_pat_). One redaction list now covers every write path. tam redact-existing finds what earlier versions stored and, with --apply, backs up the store and redacts it.
  • The memory directory is owner-only (0700 / 0600).
  • The local dashboard no longer sends Access-Control-Allow-Origin: *. The dashboard and the MCP HTTP transport check Host and Origin against DNS rebinding.

After upgrading
If the first start logs clients that keep an API key in plain text, run tam setup --reconfigure and press Enter at the key prompt. Then run tam redact-existing. Every other change and the upgrade notes are in CHANGELOG.md.

Install: pip install total-agent-memory==14.6.0 · npx -y total-agent-memory connect <ide> · brew install vbcherepanov/tap/total-memory · docker run -p 37737:37737 -v ~/.tam:/data ghcr.io/vbcherepanov/total-agent-memory:14.6.0

Assets 4
Loading